ADS-B broadcasts aircraft position worldwide with no authentication — and GNSS spoofing corrupts it. The attacks, the documented incidents since 2022, and why there is no quick fix.
EFB operational safety: lithium thermal runaway containment, failure & redundancy policy, human factors and common-mode risk — plus AI-era EFBs from 2026 on.
How the industry defends EFBs: DO-326A/ED-202A airworthiness security, MDM hardening, signed chart data, AID isolation and continuous monitoring.
The EFB attack surface mapped: device tampering, chart data poisoning, AID attacks, malicious updates and supply chain — with real published aviation research.
On October 30, 2024, Canadian authorities arrested a 26-year-old Kitchener, Ontario man on a US warrant connecting him to the Snowflake-account intrusions tracked by Mandiant as UNC5537 — the crew behind the Ticketmaster, Santander, and AT&T disclosures that dominated 2024’s data-theft calendar. The arrest, first reported in early November by Bloomberg identifying the suspect as Connor Riley Moucka, illuminated the infostealer-credential-to-cloud kill chain and the market for stolen data. This account reconstructs the campaign, the arrest, and the MFA lessons that outlast it.
EFB regulatory framework explained: FAA AC 120-76E/AC 91-78A, EASA AMC 20-25, ICAO Doc 10020, OpSpecs, Part-IS — and the operational approval process step by step.
On November 6, 2024, Wordfence researcher István Márton disclosed CVE-2024-10924 — a CVSS 9.8 authentication bypass in Really Simple Security, the plugin securing four million WordPress sites, whose two-factor onboarding endpoint failed to validate the requesting user, granting attackers admin sessions on sites with incomplete 2FA enrollment. Patched same-day in 9.1.2, NVD-published November 14, the flaw became 2024’s definitive case study in security-plugin risk. This account walks the vulnerable code path, the four-million-site patch sprint, and why the ecosystem’s auth surface extends far past WordPress core.
By November 2024, AI-agent security research had already documented the attack class that production incidents would later make infamous. InjecAgent (March 2024, ACL Findings) benchmarked 1,054 indirect-injection scenarios across 30 agents, finding ReAct-prompted GPT-4 attacked successfully roughly a quarter of the time. Breaking Agents (July 2024) demonstrated malfunction amplification through agentic loops. Together with 2023’s foundational indirect-prompt-injection work, they mapped how tools, descriptions, and fetched content become command channels. This survey walks the papers, the hijack taxonomy, and the controls that predate the incidents.
On August 13, 2024, NIST published the final versions of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — the first formal post-quantum cryptography standards, capping an eight-year open competition and starting the migration clock for RSA and elliptic-curve infrastructure. With harvest-now-decrypt-later collection already threatening long-lived secrets and federal migration timelines targeting the 2030s, enterprises face a decade-scale cryptographic inventory and replacement program. This guide walks the standards, the threat math, and the migration playbook from inventory to hybrid deployment.
In mid-December 2024, unsealed filings in Kadrey et al. v. Meta Platforms alleged the company torrented LibGen’s pirated library while engineers warned it ‘doesn’t feel right’ on corporate laptops, stripped copyright management information with purpose-built scripts, and used a dataset a memo called ‘we know to be pirated’ — with CEO approval over executive objections. The proposed DMCA and CDAFA claims reframe the AI-copyright fight around distribution and concealment rather than fair use alone. This account walks the exhibits, the legal architecture, and the compliance lessons for every AI data program.
On 31 December 2019, foreign exchange giant Travelex took its UK and international websites and mobile apps offline following a cyberattack, an outage that also knocked out white-label travel money services at ASDA, Tesco and Sainsbury’s overnight. When the story became public on 7 January 2020, the criminals behind Sodinokibi (REvil) ransomware were demanding 4.6 million pounds, claiming to have copied more than 5GB of customer data, and the company would spend weeks rebuilding systems by hand. This account reconstructs the verified timeline, the double-extortion playbook, and how the incident contributed to an August 2020 administration that cut more than a thousand UK jobs.
On 14 January 2020, Microsoft’s first Patch Tuesday of the decade included a fix for CVE-2020-0601, a cryptographic implementation flaw in Windows CryptoAPI reported to the vendor by the U.S. National Security Agency. The bug let anyone forge TLS certificates that appeared to chain to the U.S. government’s ECC trusted root, making malicious HTTPS sites look legitimately signed. Researchers named it CurveBall, proof-of-concept exploits appeared within days, and CISA issued Emergency Directive 20-02 ordering federal agencies to hunt and patch. This is the story of how a single mishandled curve parameter undermined certificate trust Windows-wide.
New threat analyses, tool guides and hardening playbooks — delivered straight to your inbox, the moment they go live.